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Understanding Reputation Risk and Its Importance 

by Jenny Rayner 


Executive Summary 

• Reputation is a critical intangible asset; it is an indicator of past performance and future prospects. 

• Reputation is based on stakeholders’ perception of whether their experience of a business matches 
their expectations. 

• Knowing your major stakeholders, how they perceive you, and what they expect of you is vital in 
managing reputation risk. 

• Everyone working for an organization bears some responsibility for upholding its reputation. 

• Reputation risk is anything that could impact reputation — either negatively (threats) or positively 
(opportunities). 

• Risks to reputation should be integrated into the business’s enterprise risk management (ERM) 
framework so that they receive attention at the right level and appropriate actions are taken to manage 
them. 


Introduction 

Reputation is the single most valuable asset of most businesses today — albeit an intangible one. A 2007 

global survey 1 rated damage to reputation as the top risk, although half the respondents admitted that they 
were not prepared for it. Hard-earned reputations can be surprisingly fragile in the globalized, technologically 
interconnected 21st century. The trust and confidence that underpin them can be irrevocably damaged by a 
momentary lapse of judgment or an inadvertent remark. 

That is why understanding reputation risk has become a key focus for businesses in all sectors. It is now 
recognized that reputation risks need to be managed as actively and rigorously as other more quantifiable 
and tangible risks. 


Reputation and Its Value 

Reputation is an accumulation of perceptions and opinions about an organization that reside in the 
consciousness of its stakeholders. 

An organization will enjoy a good reputation when its behavior and performance consistently meet or exceed 
the expectations of its stakeholders. Reputation will diminish if an organization’s words and deeds are 

p 

perceived as failing to meet stakeholder expectations, as illustrated by the reputation equation below. 
Reputation # Experience = Expectations 

Reputation has intrinsic current value as an intangible asset. Although reputation will not appear as a 
discrete balance sheet item, it represents a significant proportion of the difference between a business’s 
market and book values (less any quantifiable intangibles such as licenses and trademarks). Since 
intangibles usually represent over 70% of market value, reputation is often a business’s single greatest 
asset. 

Reputation also plays a pivotal role in a business’s future value by influencing stakeholder behavior and, 
hence, future earnings potential and prospects. A good or bad reputation can affect stakeholder decisions 
to maintain or relinquish their stake — be they investors, customers, suppliers, or employees. The “corporate 
halo” effect of a reputable business can help to differentiate products in a highly competitive sector, may 
allow premium pricing, and can be the ultimate deciding factor for a prospective purchaser of services. A 
strong reputation can help to attract and retain high-quality employees and can deter new competitors by 
acting as a barrier to market entry. Reputation can also shape the attitude of regulators, pressure groups, 
and the media towards a business and can affect its cost of capital. 
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Perhaps the greatest benefit of a good reputation is the buffer of goodwill it provides, which can enable a 
business to withstand future shocks. This “reputational capital,” or “reputation equity,” underpins stakeholder 
trust and confidence and can persuade stakeholders to give a business the benefit of the doubt and a 
second chance when the inevitable unforeseen crisis strikes. 


Defining Reputation Risk 

Reputation risk should be regarded as a generic term embracing the risks, from any source, that can impact 
reputation, and not as a category of risk in its own right. Regulatory noncompliance, loss of customer data, 
unethical employee behavior, or an unexpected profit warning can all damage reputation and stakeholder 
confidence. 

Reputation risk is not only about downside threats, but also about upside opportunities. Climate change, for 
example, is a potential business threat, but many firms have spotted and exploited the flip-side opportunity 
for competitive advantage by developing green technologies and promoting themselves as environmentally 
friendly, thereby enhancing their reputation. 

Reputation risk can therefore be defined as: 

“Any action, event or situation that could adversely or beneficially impact an organization’s reputation.” 


Identifying Reputation Risks 

The most crucial stage of the reputation risk management process is identifying the factors that could 
impact reputation. Risks have to be recognized and understood before they can be managed. Considering 
the seven drivers of reputation is a useful starting point, as these are also fertile sources of threats and 
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opportunity to reputation (see figure above. ) 



Figure 1 .The seven drivers of reputation 

Businesses should consider not only the risks under their direct control, but also risks in the “extended 
enterprise” relating to suppliers, subcontractors, business partners, advisers, and other stakeholders. 

Could the values, business practices, or activities of its partners expose the business to reputation risk by 
association? 

One way of approaching this is to consider the expectations of each major stakeholder group against the 
drivers of business reputation to develop a “heat map” of potential trouble spots and zones of opportunity. 
Major mismatches between expectations and experience can be analyzed to highlight areas where action is 
needed to bridge the gaps. 

Asking the following questions may also help to uncover reputation risks: 

• What newspaper headline about your business would you least (or most) like to see? What could 
trigger this? 
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What could threaten your core business values or your license to operate? Such risks can seriously 
damage reputation and lead to an irreversible loss of stakeholder confidence. 

Could there be collateral risk arising from the activities of another player in your sector? If so, the 
reputation of your own business may be vulnerable and come under intense stakeholder scrutiny. 
Could reputation risk exposure arise from an acquisition, merger, or other portfolio change? A 
mismatch of values, ethos, culture, and standards resulting in inappropriate behavior could seriously 
damage reputation. Conversely, if the acquisition target enjoys a superior reputation, it could provide a 
competitive edge. 


Evaluating, Responding To, Monitoring, and Reporting Risks 

Once risks to reputation have been identified, they can be evaluated, appropriate risk responses developed, 
and the risks monitored and reported. 

Risks to reputation can be evaluated in the usual way by considering the likelihood of the risk occurring and 
the impact if it does. The reputational impact of such risks should be considered explicitly, alongside financial 
or other impacts. This can be done by the use of a word model which explains reputational impact in a way 
that is relevant and meaningful for a given business. The table below provides an example of a four-point 
reputation impact scale that caters for both threats and opportunities. 

Table 1 


Low 

Moderate 

High 

Very high 

Local complaint or 
recognition Minimal 
change in stakeholder 
confidence Impact lasting 
less than one month 

Local media coverage 
Moderate change in 
stakeholder confidence 
Impact lasting between 
one and three months 

National media coverage 
Significant change in 
stakeholder confidence 
Impact lasting more than 
three months Attracts 
regulator attention or 
comment 

National headline/ 
international media 
coverage Dramatic 
change in stakeholder 
confidence Impact lasting 
more than 12 months 
or irreversible Public 
censure or accolade by 
regulators 


In assessing reputational impact, the view of relevant stakeholders should be considered to ensure that the 
impact is not underestimated. That is why understanding stakeholders and what they regard as current and 
emerging major issues lies at the heart of reputation risk management. 


Reputational impact can sometimes be quantified in monetary terms — for example, expected reduced 
income resulting from loss of customers or license to operate; or impact on share price or on brand value. 
The true ultimate impact can be difficult to estimate as the immediate consequence may be only a relatively 
small financial penalty (for example, a fine for pollution). However, the event may, over time, have an 
insidious effect which erodes the business’s reputation (for example, because of a perception that the 
business is not concerned about the environment). 

Response plans should be developed to manage the more significant risks that present unacceptable 
exposure to the business. The gap between experience and expectation can be bridged by improving the 
business’s performance or behavior and/or by influencing stakeholder expectations so they are more closely 
aligned with what the business can realistically deliver. As reputation is based on stakeholder perception, 
focused and clear communication to stakeholders is vital so that their perception will accurately reflect 
business reality. 

A business may have done everything possible to anticipate and guard against reputational threats, but if a 
crisis strikes and the business response is inappropriate, its reputation may still end up in tatters. Having an 
effective and well-rehearsed generic crisis management plan that can be quickly adapted and implemented 
to suit specific circumstances is therefore a key component of an effective reputation risk management 
strategy. 

Once risks to reputation have been identified and responses agreed and implemented, the risks can be 
regularly monitored by management to ensure that responses are having the desired effect. Finally, the up- 
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to-date status of the risks should be reported at the right level to inform decision-making and enable external 
disclosure to stakeholders. 


Roles and Responsibilities 

The board of a business is the ultimate custodian of a business’s reputation. However, managing reputation 
risk successfully requires a team effort across the business from executive and nonexecutive directors, 
senior and middle managers, public relations staff, risk and audit professionals, and key business partners. 

Everyone employed by and indirectly working for a business should be expected to uphold the business's 
values and bear some responsibility for spotting emerging risks that could impact reputation. The telltale 
signs of an imminent crisis are often missed because personnel are not risk-aware: a spate of customer 
complaints, safety near-misses or supplier nonconformances, a sudden rise in employee turnover, or 
pressure group activity. These can act as crucial early warning indicators which allow a business to take 
corrective action and avert disaster. 


Case Study 

Citigroup 

In September 2004 the Financial Services Agency (FSA), Japan’s bank regulator, ordered Citigroup to close 
its private banking business in the country following “serious violations” of Japanese banking laws. An FSA 
investigation found that inadequate local internal controls and lack of oversight from the United States had 
allowed large profits to be “amassed illegally.” The bank had failed to prevent suspected money laundering 
and had misled customers about investment risk. The punishment meted out by the FSA was particularly 
severe as a previous inspection in 2001 had exposed similar compliance weaknesses, which Citigroup had 
not corrected. 

Citigroup’s then chief executive, Charles Prince, visited Japan in October 2004 in an attempt to repair the 
company’s tarnished image. Bowing, he apologized for the activities of his senior staff, saying that they had 
put “short-term profits ahead of the bank’s long-term reputation.” He pledged to improve oversight, change 
the management structure, increase employee training on local regulations, and set up an independent 
committee to monitor progress. He said: “Under my leadership, lack of compliance and inappropriate 
behavior simply will not be tolerated and we will take direct action to ensure that proper standards are upheld 
and that these problems do not reoccur.” 

That same month French retailer Carrefour fired Citigroup as a financial adviser on the sale of its Japanese 
operations to prevent its own reputation from being tarnished by association. 


Conclusion 

A good reputation hinges on a business living the values it claims to espouse and delivering consistently 
on the promise to its stakeholders. Being “authentic,” being “the real thing,” has never been so important. 
Pursuing short-term gain at the expense of long-term business reputation and stakeholder interests is no 
longer acceptable practice. 

Successfully managing reputation risk is both an inside-out and an outside-in challenge. The inside-out 
component requires business leaders to establish an appropriate vision, values, and strategic goals that will 
guide actions and behaviors throughout the organization. The outside-in component requires the business to 
continuously scan the external environment and canvass stakeholder opinion to ensure it is on a track that 
will secure the continuing support, trust, and confidence of its stakeholders. 

Active and systematic management of the risks to reputation can help to ensure that perception is aligned 
with reality and that stakeholder experience matches expectations. Only in this way can a business build, 
safeguard, and enhance a reputation that will be sustainable in the long term. 
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Making It Happen 

The key components of reputation risk management are: 

• Clear and well-communicated business vision, values, and strategy that set the right ethical and 
stakeholder-aware tone for the business. 

• Supporting policies and codes of conduct that guide employee behavior and decision-making so that 
goals are achieved in accordance with business values. 

• Extension of the business’s values and relevant policies to key partners in the supply chain. 

• Dialogue and engagement to track the changing perceptions, requirements, and expectations of major 
stakeholders continuously. 

• An effective enterprise-wide risk management system that identifies, assesses, responds to, monitors, 
and reports on threats and opportunities to reputation. 

• A culture in which employees are risk-aware, are encouraged to be vigilant, raise concerns, highlight 
opportunities, and act as reputational ambassadors for the business. 

• Transparent communications that meet stakeholder needs and build trust and confidence. 

• Robust and well-rehearsed crisis management arrangements. 


More Info 

Books: 

• Atkins, Derek, Ian Bates, and Lyn Drennan. Reputational Risk: Responsibility Without Control? A 
Question of Trust. London: Financial World Publishing, 2006. 

• Fombrun, Charles J., and Cees B. M. van Riel. Fame and Fortune: How Successful Companies Build 
Winning Reputations. Upper Saddle River, NJ: FT Prentice Hall, 2003. 

• Larkin, Judy. Strategic Reputation Risk Management. Basingstoke, UK: Palgrave MacMillan, 2003. 

• Rayner, Jenny. Managing Reputational Risk: Curbing Threats, Leveraging Opportunities. Chichester, 
UK: Wiley, 2003. 

Article: 

• See articles in The Geneva Papers on Risk and Insurance Issues and Practice 31 :3 (July 2006). Find 
issue in “Archive” at: www.palgrave-journals.com/gpp 

Reports: 

• Coutts and Company. “Face value: Your reputation as a business asset.” London: Coutts and 
Company, 2008. 

• Economist Intelligence Unit. “Reputation: Risk of risks.” White paper, 2005. 

• Resnick, Jeffrey T. “Reputational risk management: A framework for safeguarding your organization’s 
primary intangible asset.” Opinion Research Corporation, 2006. Online at: www.carma.com/ 
Reputational_Risk_White_Paper.pdf 

Websites: 

• The John Madejski Centre for Reputation, Henley Business School at the University of Reading — 
search on “Madejski” at: www.henley.reading.ac.uk 

• Reputation Institute: www.reputationinstitute.com 


Notes 

1 Aon’s Global Risk Management Survey, based on responses from 320 organizations in 29 countries. 
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Oonagh Mary Harpur in Chapter B4 of Corporate Social Responsibility Monitor. London: Gee Publishing, 
2002 . 

3 Rayner, 2003. 
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See Also 

Best Practice 

• CSR: More than PR, Pursuing Competitive Advantage in the Long Run 

• Fraud: Minimizing the Impact on Corporate Image 

• Internal Auditors and Enterprise Risk Management 

• Managing 21st Century Finances 

• The Value and Management of Intellectual Property, Intangible Assets, and Goodwill 
Checklists 

• Defining Corporate Governance: Its Aims, Goals, and Responsibilities 

• Understanding Crisis Management 

To see this article on-line, please visit 

http://www.qfinance.com/business-strategy-best-practice/understanding-reputation-risk-and-its-importance9full 
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